CVE-2020-8793: Race Condition
Last updated 26 August 2025
Other sources
OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensmtpdto a version that resolves this vulnerability.Fixed in 6.8.0p2-3Fixed in 6.8.0p2-4Fixed in 7.6.0p1-1Fixed in 7.8.0p0-2 - Upgrade
Upgrade
OpenSMTPDto a version that resolves this vulnerability.Fixed in 6.6.4 - Compensating control
Ensure /proc/sys/fs/protected_hardlinks is enabled (Ubuntu ships it enabled by default), as this makes the described OpenSMTPD vulnerability not exploitable.
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2020-8793.
What is the severity of CVE-2020-8793?
The severity of CVE-2020-8793 is medium.
How does CVE-2020-8793 impact OpenSMTPD?
CVE-2020-8793 allows local users to read arbitrary files on some Linux distributions due to an untrusted search path and race conditions in OpenSMTPD.
Which versions of OpenSMTPD are affected by CVE-2020-8793?
OpenSMTPD versions before 6.6.4 are affected by CVE-2020-8793.
How can I mitigate the vulnerability CVE-2020-8793?
To mitigate CVE-2020-8793, you should update OpenSMTPD to version 6.6.4 or apply the recommended fixes for your specific distribution.